I don't know what makes you think this instruction is "broken" - the fact that there is a comma right after a bracket, without a parameter in between? In this case, the disassembler just doesn't show the parameter because it's "zero" (more precisely, it specifies "no register" where "any processor register" would be allowed).
What happens here is: when addressing memory locations, the processor has a mode where it adresses
- a base offset
- plus the content of one processor register
- plus the content of another processor register, multiplied by an integer that can be 1,2,4 or 8
This calculation is quite fast, as it's done in special hardware in the address bus subsystem.
The lea
(load effective address) instruction is a special kind of RAM access -- it calculates the address of the operand, but then, it moves the address, not the data at that address, into the destination register.
So your 'broken' instruction moves a base offset of 0, plus "no" first register, plus 8 times the content of ebp, into eax. The same could have been done by moving ebp to eax and multiplying by 8, or moving and shifting left by 3 bits, but the lea
instruction is probably a bit faster (because, as i said, it's done in specialized address bus hardware), so the compiler used that one to save a few cycles. Nothing is broken here.
You might want to take a look at a i386 assembler reference when disassembling, the indirect adressing is quite well explained in the OS X Assembler reference, scroll down to "Indirect Memory Operands".